netsfs - Network Statistics File System

Warning!!

This is an experimental Linux kernel module. Use at your own risk! You have been warned.

Clone at github Download .zip

About

netsfs - Network Statistics file system, is a pseudo file system to debug network packets. You can debug your network, simply by analyzing structures of directories and files, you do not need a sniffer or libpcap.


Download and compile

This code was tested with linux kernel > 3.2.0

$ git clone https://github.com/beraldoleal/netsfs.git
$ cd netsfs
$ make clean
$ make

The netsfs.ko file should be created.


Load the module

$ sudo insmod netsfs.ko
$ dmesg | tail -1
[  295.436806] Kernel now with netsfs support.

Mount the virtual file system

$ sudo mkdir /net
$ sudo mount -t netsfs none /net

Debug!

$ sudo ls -la /net
total 4
drwxr-xr-x  3 root root 1470 Jul 21 18:09 .
drwxr-xr-x 24 root root 4096 Jun  4 18:06 ..
----------  1 root root    0 Jul 21 18:09 debug
d---------  3 root root 1470 Jul 21 18:09 ipv4/
----------  1 root root    0 Jul 21 18:09 stats
----------  1 root root    0 Jul 21 18:09 stream

Each tcp/ip layer has your own directory:

$ sudo ls -la /net/ipv4/tcp/ssh
total 0
d--------- 2 root root  680892 Jul 21 18:09 .
d--------- 4 root root 2158781 Jul 21 18:10 ..
---------- 1 root root       0 Jul 21 18:09 stats
---------- 1 root root       0 Jul 21 18:09 stream

Few statistics

$ sudo cat /net/ipv4/stats
bytes: 2278517
count: 10952

Consuming the packet buffer

$ sudo cat /net/ipv4/stream
[    MAC    ] ts: 1374445555362159557, dev: eth0, len: 114, type: ipv4
[  NETWORK  ] version: 4, tos: 10, id: 9dd0, protocol: tcp, 192.168.122.192 -> 192.168.122.1
[ TRANSPORT ] 22 -> 45204[PSH][ACK]

Increase the debug level

$ sudo echo 1 > /net/debug
$ sudo cat /net/ipv4/stream
[    MAC    ] ts: 1374445714240422779, dev: eth0, len: 100, type: ipv4
[  NETWORK  ] version: 4, tos: 10, id: 3b83, protocol: tcp, 192.168.122.1 -> 192.168.122.192
[ TRANSPORT ] 45204 -> 22[PSH][ACK]
45 10 00 64 83 3b 40 00 40 06 41 36 c0 a8 7a 01  E..d.;@.@.A6..z.
c0 a8 7a c0 b0 94 00 16 f4 46 4d 75 8c 78 25 73  ..z......FMu.x%s
80 18 01 4b 12 48 00 00 01 01 08 0a 03 74 94 fc  ...K.H.......t..
00 0b 58 48 84 b8 65 e9 58 aa 6a 89 c2 47 52 b5  ..XH..e.X.j..GR.
f3 90 77 b4 11 09 a8 8a 06 f2 7f 6c a1 d1 f2 ea  ..w........l....
f1 ca 8d 9d 81 42 cf 02 46 82 c2 3c f7 a5 d8 5c  .....B..F..<...\
64 f2 47 a0                                      d.G.

Bugs and contributing

If you like of idea, has comments or found a bug, please drop-me an email beraldo AT ime DOT usp DOT br

I'm also online at irc.oftc.net, user beraldo.


Thanks

I would like to thank all the people who helped, in particular: